AFI-ID: adaptive feature intelligence for intrusion detection
- 1School of Computer Science and Engineering, Vellore Institute of Technology , , ,
Abstract
The increasing sophistication of cyber-attacks necessitates intrusion detection systems (IDS) that are both accurate and computationally efficient, particularly in high-dimensional and class-imbalanced environments. Although ensemble-based IDS models enhance predictive performance, most existing approaches treat feature selection and ensemble aggregation as independent stages, limiting integrated optimization between feature representation and decision-making. To overcome these limitations, this paper proposes Adaptive Feature Intelligence for Intrusion Detection (AFI-ID), an intrusion detection framework that integrates hybrid adaptive feature intelligence with attention-based deep stacking. The proposed AFI module combines statistical relevance measures—Mutual Information and Chi-square with model-based importance derived from XGBoost and Extra Trees through a weighted fusion strategy. This strategy enables the selection of a compact and discriminative feature subset while preserving sensitivity to minority attack classes. At the ensemble level, heterogeneous base learners generate structured meta-features, including log-probability representations, prediction confidence, and entropy. These meta-features are processed by an attention-based Bidirectional Long Short-Term Memory (BiLSTM) meta-classifier, which dynamically weights classifier contributions to achieve context-aware decision fusion. Experimental evaluation on the UNSW-NB15 and CICIDS2017 datasets under binary and multiclass settings demonstrates that AFI-ID achieves strong performance relative to the evaluated baseline classifiers under the experimental protocols considered in this study. AFI-ID achieves 93.31% accuracy with a Receiver Operating Characteristic—Area Under Curve (ROC-AUC) of 0.9849 in binary classification and 79.95% accuracy with a ROC-AUC of 0.9845 in multiclass classification on UNSW-NB15. On CICIDS2017, AFI-ID achieves 98.33% accuracy with a ROC-AUC of 0.9976 in binary classification and 93.54% accuracy with a ROC-AUC of 0.999 in multiclass classification. In repeated UNSW-NB15 binary experiments across five random seeds, AFI-ID achieved a mean accuracy of 93.62%, with paired t-tests indicating statistically significant improvements over Logistic Regression (p = 1.08 × 10−10), Extra Trees (p = 1.38 × 10−5), and XGBoost (p = 3.69 × 10−5). These results demonstrate the effectiveness of the proposed adaptive feature selection and attention-based decision fusion strategy under high-dimensional and class-imbalanced network traffic conditions.
Related
- Causality-driven hybrid intrusion detection with entropy-aware feature learning and federated intelligence
- Protocol-Aware Feature-Based Intrusion Detection System for UAVCAN Networks
- Parallel Local–Global Feature Extraction and Cross-Attention Gated Fusion for Network Intrusion Detection
- DEA-IDS: Drift-Aware Feature Selection and Few-Shot Adaptation for Cross-Domain IoT–IoMT Intrusion Detection
- Secure signal encoding and temporal feature extraction for multi class intrusion detection in smart grid environments
BibTeX
@article{raj2026afiid,
title = {{AFI-ID: adaptive feature intelligence for intrusion detection}},
author = {S. Antony Joseph Raj and M. Madiajagan},
journal = {Frontiers in artificial intelligence},
year = {2026},
month = oct,
doi = {10.3389/frai.2026.1950536},
url = {https://europepmc.org/article/PMC/PMC13724397},
note = {CC BY},
}
RIS
TY - JOUR
TI - AFI-ID: adaptive feature intelligence for intrusion detection
AU - S. Antony Joseph Raj
AU - M. Madiajagan
PY - 2026
DA - 2026/10/19
JO - Frontiers in artificial intelligence
DO - 10.3389/frai.2026.1950536
UR - https://europepmc.org/article/PMC/PMC13724397
AB - The increasing sophistication of cyber-attacks necessitates intrusion detection systems (IDS) that are both accurate and computationally efficient, particularly in high-dimensional and class-imbalanced environments. Although ensemble-based IDS models enhance predictive performance, most existing approaches treat feature selection and ensemble aggregation as independent stages, limiting integrated optimization between feature representation and decision-making. To overcome these limitations, this paper proposes Adaptive Feature Intelligence for Intrusion Detection (AFI-ID), an intrusion detection framework that integrates hybrid adaptive feature intelligence with attention-based deep stacking. The proposed AFI module combines statistical relevance measures—Mutual Information and Chi-square with model-based importance derived from XGBoost and Extra Trees through a weighted fusion strategy. This strategy enables the selection of a compact and discriminative feature subset while preserving sensitivity to minority attack classes. At the ensemble level, heterogeneous base learners generate structured meta-features, including log-probability representations, prediction confidence, and entropy. These meta-features are processed by an attention-based Bidirectional Long Short-Term Memory (BiLSTM) meta-classifier, which dynamically weights classifier contributions to achieve context-aware decision fusion. Experimental evaluation on the UNSW-NB15 and CICIDS2017 datasets under binary and multiclass settings demonstrates that AFI-ID achieves strong performance relative to the evaluated baseline classifiers under the experimental protocols considered in this study. AFI-ID achieves 93.31% accuracy with a Receiver Operating Characteristic—Area Under Curve (ROC-AUC) of 0.9849 in binary classification and 79.95% accuracy with a ROC-AUC of 0.9845 in multiclass classification on UNSW-NB15. On CICIDS2017, AFI-ID achieves 98.33% accuracy with a ROC-AUC of 0.9976 in binary classification and 93.54% accuracy with a ROC-AUC of 0.999 in multiclass classification. In repeated UNSW-NB15 binary experiments across five random seeds, AFI-ID achieved a mean accuracy of 93.62%, with paired t-tests indicating statistically significant improvements over Logistic Regression (p = 1.08 × 10−10), Extra Trees (p = 1.38 × 10−5), and XGBoost (p = 3.69 × 10−5). These results demonstrate the effectiveness of the proposed adaptive feature selection and attention-based decision fusion strategy under high-dimensional and class-imbalanced network traffic conditions.
SN - 2624-8212
ER -